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IN THE UNITED STATES DISTRICT COURT FOR THE 
DISTRICT OF COLUMBIA 



Case No- 
UNDER SEAL 



IN THE MATTER OF THE SEARCH OF 
ALL RECORDS RELATING TO THE 
E-mail ADDRESSES 
OLEMBEOLE@YAHOO . COM 
LOCATED AT THE OFFICES OF 
YAHOO! INC., 701 FIRST AVENUE 
SUNNYVALE, CALIFORNIA 



AFFIDAVIT FOR SEARCH WARRANT 
I, Charles E. Price, II, having been duly sworn, hereby 
depose and say: 

1. I am a Special Agent of the Federal Bureau of 
Investigation (FBI) and have been so employed for over 19 years. 
While I have investigated a wide variety of crimes, I have spent 
the majority of my career investigating white collar crimes, 
including bank frauds, wire frauds, and money laundering. I am 
currently assigned to a white collar crime squad at the FBI's 
Washington Field Office. I am the Case Agent on an investigation 
into allegations that an individual (s) is attempting to extort 
$2,000,000.00 from The Christian Science Monitor (CSM) , in 
exchange for securing the release of Jill Carroll, a CSM reporter 
who has been kidnaped in Iraq. 

2. The facts and information contained in this affidavit are 
based upon my personal knowledge as well as observations of other 
United States Government officials involved in this 
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investigation. All observations that were not personally made by 
me were related to me by the persons who made them or by 
representatives of those persons. This affidavit does not 
contain each and every fact known to the government, but only 
those necessary to support a finding of probable cause, 

3. This affidavit is made in support of an application for a 
search warrant for certain accounts controlled by the web-based 
electronic mail service provider known as Yahooi, Inc. ("Yahoo"), 
headquartered at 701 First Avenue, Sunnyvale, California 94089. 
The accounts to be searched are: saidu_mhmmd@yahQo . com and 
olembeole@yahoo . com . For the reasons detailed below, I believe 
that there is probable cause to believe that on the computer 
systems of Yahoo, there exists evidence, fruits, and 
instrumentalities of violations of Title 18, United States Code, 
Sections 8 75 (foreign communications requesting ransom/ reward for 
the release of a kidnaped person) and 1343 (wire fraud) , as 
described in Attachment B to this affidavit. 

4. Although Yahoo is located in California, I am submitting 
this affidavit in the District of Columbia pursuant to Title 18, 
United States Code, Section 2703(c) (1) (A), which authorizes any 
court with jurisdiction over an offense to issue a search warrant 
for the records of an electronics communication service provider. 



. Case 1 :06-mj-001 1 0-tf1^F Document 1 -2 Filed 03/1 3/2©06 Page 3 of 1 5 

Case Facts and Probable Cause 

5. On January 1 , 2006, gunmen in Iraq kidnaped Jill Carroll 
("Carroll")/ an American journalist working on assignment in Iraq 
for CSM. Since her abduction, Carroll's abductors have released 
videos containing threats to kill her, including a threat to kill 
her if the United States does not meet their demands by Sunday, 
February 26, 2006. 

6. On February 12, 2006, David Cook ("Cook"), CSM's 

Washington Bureau Chief, received an e-mail from 

saidu_mhmmd@yahoo . com which states in part: 

"i can give you informations (sic) to secure the release of 
jill Carroll, i am mujaheeden and i can give every information 
that can lead to securing her release .... i am impatiently 
waiting to read from you for futher directives and 
negotiations. . . . saidu mohammed" 

7. Cook responded to Saidu Mohammed's ("Mohammed") e-mail 
and requested further details on steps he should take to secure 
Carroll's release. Cook transmitted his response via an e-mail 
message which he sent to saidu_mhmmd@yahoo . com . 

8. On February 13, 2006, Cook received an e-mail message 

from saidu_mhmmd@yahoo . com which states, in part: 

"i need to have personal contact with you.., give me your 
contact number... the intent is to kill jill so as to tell america 
we are not playing . . . send me your number now so i can call you, 
i will be leaving for germany tomorrow ... i will be calling you 
from there and that will give me time to negotiate with you." 

9. Cook responded to Mohammed's e-mail and provided Mohammed 
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with his work and cell phones. Cook transmitted his response via 
an e-mail message which he sent to saidu_mhmmd@Yahoo , com . 

10. On February 14, 2006, Cook received an e-mail message 

from saidu_mhmmd@YahoQ . com which states, in part: 

"at the moment jills (sic) life is in serious danger so i 
had to abort my trip to germany ... jill is about to be smuggled 
to the mujaheeden camp in syria where she will undoubtedly be 
executed . . the plans (sic) is to kill her before the expiration 
of the deadline, but i am doing everything to ensure the decision 
is delayed. . .1 spoke with jill .... she promised to assist me go 
(sic) with her to america if i help get her free ... so to ensure 
this i had to motivate two other brigades who must (sic) have to 
help me ... the other two brigades who are secretly working with 
me are demanding a ransom . . . you can raise two million dollars 
or else jill is likely to become history, this is what the other 
two brigades are demanding in other (sic) to betray the 
mujaheeden.... we don^t (sic) have much time left ... reply 
immediately so i know when this money will be available." 

11. After receiving the e-mails from Mohammed, Cook 
contacted the FBI and counter-terrorism Agents began an 
investigation in an attempt to determine whether the person 
communicating with Cook was, in fact, in a position to assist in 
the release of Carroll. The counter-terrorism Agents determined 
that the incoming e-mails were being sent from an internet 
service provider ("ISP") address in Germany. Pursuant to 18 
U.S.C. § 2702(b), the counter-terrorism Agents accessed the 
saidu_mhmmd@yahoo . com e-mail and determined that the user of this 
e-mail account was sending out multiple communications soliciting 
participation in what are commonly referred to as Nigerian 
advance fee schemes . 
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12. Based on a review of the e-mails and the fact that the 
e-mails were being sent from Germany (versus Iraq, as Mohammed 
claimed) , the counter-terrorism Agents came to the conclusion 
that the individual communicating with Cook was not, in fact, 
associated with Carroll's kidnapers and was merely posing as one 
of Carroll's kidnapers in an attempt to extort money from CSM. 
Based on this conclusion, the counter-terrorism Agents stopped 
their investigation and on February 15, 2006, referred the case 
to me, as I investigate frauds. 

13. At my direction. Cook has had repeated contacts, via 
both e-mail and telephone, with the individual who has identified 
himself as Saidu Mohammed. During the telephone conversations 
and e-mails, Mohammed continues to request $2,000,000.00 in 
exchange for securing Carroll's release. As a result of 
"negotiations," Mohammed has agreed to accept $1,000,000.00 in 
advance of Carroll's release and the remaining $1,000,000.00 
after she has been released. Mohammed has provided details 
regarding a bank account in Germany, complete with wire transfer 
instructions, and has directed Cook to wire transfer 
$1,000,000.00 to that account. The actual purpose of Cook's 
continued contact with Mohammed is to develop evidence which 
would assist in determining the actual identity and location of 
the individual with whom Cook is communicating and the identity 
and location of those who may be assisting Mohammed in his 
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extortion attempt . 

14. All of the incoming e-mails which Cook has received 
have came from the saidu_mhmmd@vahoQ . com account and he has sent 
all of his e-mail responses to the saidu_mhmmd@yahoo . com account. 

15. In connection with the negotiations, on March 4, 2006, 
Cook received an e-mail from the saidu_mhmmd@yahoo . com account 
containing the following text, which was located below the e- 
mail's "subject" line but before the e-mail's substantive 
message : 

"olembe olembe < olembeole@Yahoo . com> wrote:" 

16. Based on the presence of this Yahoo account header, it 
appears that the substantive text of the e-mail received from the 
saidu_mhmmd@yahoo . com account may have been drafted when the 
author of the e-mail was signed on to the internet under the 
olembeole@yahoo . com account. It appears that the e-mails' author 
may have cut and pasted the substantive text to the 
saidu_mhmmd@yahoo , com account, from which it was sent to Cook. 

In any event, the text of the incoming e-mail clearly indicates 

that it was drafted by olembeole@yahoo . com. The e-mail reads, in 

part : 

"i am the only one who can save jill ... i do not want the 
one million from you to use it and (sic) sponsor jihad ... i only 
want to give it to the two brigades who are working with me" 

17. Based on my experience, it is not unusual for 
individuals who are committing fraud, particularly advance fee 
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schemes, to attempt to conceal their true identity and location 
by using aliases. It is also my experience that individuals 
attempting to conceal their identities frequently communicate via 
e-mail accounts which can be opened under any name and opened 
without any verification of actual identity of the person 
opening/operating the account. Based on my experience, there is 
reason to believe that an analysis of the contents of the e-mail 
accounts may reveal evidence which, individually or collectively, 
would assist in determining the location and identity of the 
actual individual operating the account. 

Technical Background Regarding Computers, 
The Internet/ E-mail, Yahoo and Search Protocol 
18. The Internet is a worldwide network of computer systems 
operated by governmental entities, corporations, and 
universities. The term "computer" as used herein is defined in 
18 U.S.C. § 1030(e) (1), and includes an electronic, magnetic, 
optical, electrochemical, or other high speed data processing 
device performing logical, arithmetic, or storage functions, and 
includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device. 
In order to access the Internet, an individual computer user must 
subscribe to an access provider, which operates a host computer 
system with direct access to the Internet. The world wide web 
("www") is a functionality of the Internet which allows users of 
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the Internet to share information; 

19. With a computer connected to the Internet, an individual 
computer user can make electronic contact with millions of 
computers around the world. This connection can be made by any 
number of means, including modem, local area network, wireless 
and numerous other methods; and 

20. E-mail is a popular form of transmitting messages 
and/or files in an electronic environment between computer users. 
When an individual computer user sends e-mail, it is initiated at 
the user's computer, transmitted to the subscriber's mail server, 
then transmitted to its final destination. A server is a 
computer that is attached to a dedicated network and serves many 
users. An e-mail server may allow users to post and read 
messages and to communicate via electronic means. 

21. The following provides a general description of what 
Yahoo is and how it operates: 

a. Yahoo is an Internet services company that 
provides e-mail services which are available to subscribers for 
free (or for a monthly fee depending on the level of service 
provided) . Subscribers obtain an account by registering on the 
Internet with Yahoo. Yahoo requests subscribers provide basic 
information, such as name, gender, zip code and other personal 
and biographical information. Yahoo does not generally verify 
the information provided by subscribers; 



8 



■ Case 1 :06-mj-001 1 0-Mf Document 1 -2 Filed 03/1 3/2W16 Page 9 of 1 5 

b. Subscribers to Yahoo may access their Yahoo 
accounts using the Internet; 

c. Any e-mail that is sent to a Yahoo subscriber is 
stored in the subscriber's "mail box" on a server hard drive 
under the control of Yahoo. If the message is not deleted by the 
subscriber, that message can remain on the Yahoo server hard 
drive indefinitely; 

d. When a Yahoo subscriber sends an e-mail, it is 
initiated on the Yahoo server and then transmitted to its end 
destination through the Internet. The Yahoo subscriber who sent 
the e-mail has the option of saving a copy of the e-mail sent. 
Depending on the election of the subscriber, the e-mail can 
remain on the system indefinitely; 

e. A Yahoo subscriber can store files, including e- 
mails, text files, and image files, in the subscriber's account 
on the Yahoo servers; and 

f . E-mails and other files stored by a Yahoo 
subscriber in a Yahoo Account are not necessarily also located 
on the computer used by the subscriber to access the Yahoo 
account. The subscriber may store e-mails and other files in 
their Yahoo account server exclusively. A search of the files in 
the subscriber's computer will not necessarily uncover the files 
that the subscriber has stored on the Yahoo server. In addition 
communications sent to the Yahoo subscriber by another, but not 
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yet retrieved by the subscriber, will be located on the Yahoo 
server in the subscriber's account, but not on the computer used 
by the subscriber. 

22. With regard to venue. Cook has received some telephone 
calls from Mohammed while he (Cook) was in Washington, DC and 
technical coverage on some of the calls shows that the calls were 
place from a Germany phone number. In addition, investigation has 
determined that Mohammed's e-mails originate from an ISP in 
Germany and some of the Mohammed's e-mails were received by Cook 
while he (Cook) was in Washington, DC. 

23. Although Yahoo is located in California, I am 
submitting this affidavit in the District of Columbia pursuant to 
Title 18, United States Code, Section 2703(c) (1) (A), which 
authorizes any court with jurisdiction over an offense to issue a 
search warrant for the records of an electronics communication 
service provider. 

CONCLUSION 

24. Based upon foregoing, I have probable cause to believe 
that on the computer systems owned, maintained, and operated by 
Yahoo, 701 First Avenue, Sunnyvale, California, as further 
described in Attachment A to this affidavit, there are evidence, 
fruits, and instrumentalities of violations of Title 18, United 
States Code, Sections 8 75 (foreign communications requesting 
ransom/reward for the release of a kidnaped person) and 1343 
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(wire fraud) . Accordingly, by this affidavit and application, I 
respectfully request that the Court issue a search warrant 
directed to Yahoo allowing agents to obtain the data storage, e- 
mail and other information stored on the Yahoo servers, as 
further described in Attachment B, relating to the computer 
accounts with the e-mail addresses: saidu_mhmmd@Yahoo .corn , and 
Qlembeole@vahQO . com , 

25. Additionally, pursuant to Title 18, United States Code, 
Section 2 703 (g) , I request authority to serve the warrant on 
Yahoo by facsimile (with their permission) and, to allow Yahoo to 
conduct the search and copy the data outside of my presence. 



a^ict^ 



Charles E. Price, II 

Special Agent 

Federal Bureau of Investigation 



Subscribed and sworn to before me 
this // day of March, 2006. 





nited States Magistrate Judge 
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ATTACHMENT A 
DESCRIPTION OF SEARCH LOCATION 

Computer systems at the offices of Yahoo 1 Inc., located at 
701 First Avenue, Sunnyvale, California. 
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ATTACHMENT B 

I. Service of Warrant and Copying of Computer Files by Yahoo 

A. The Officer or Agent executing this warrant shall effect 
service by any lawful method including faxing the warrant (with 
Yahoo's consent) to the Yahoo office at the location specified in 
the warrant . 

B. The Officer or Agent executing this warrant shall permit 
Yahoo, as custodian of the computer files described in Section II 
below, to locate the files, copy them onto removable electronic 
storage media or print them out as paper copies (or use a 
different copying method if specified in Section II below) , and 
deliver the copies to the officer or agent, who need not be 
present during this process at the location specified in the 
warrant . 

C. Pursuant to 18 U.S. C. § 2703(b) (1) (A), Yahoo and its 
agents are hereby prohibited from notifying the subscriber (s) of 
the above- listed Yahoo accounts, or anyone else, of the search 
warrant . 

D. The U.S. Department of Justice and shall not be 
prohibited from sharing information obtained from this warrant 
with other law enforcement and intelligence agencies, including 
foreign law enforcement and intelligence agencies, for use in 
investigation and prosecution. 

II. Items To Be Seized - Files and Accounts To Be Copied and 
Delivered by Yahoo 
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Any and all records and other information relating to the 
accounts associated with the following e-mail address: 
saidu_mhmmd@vahoo . com, and olembeole@vahoo.com . including, but not 
limited to, the following: 

A. All e-mail, voice mail, facsimiles, and any other 
electronic communications, along with their contents, including 
headers and attachments, sent to, sent from or received by the 
subscriber/account, whether saved or deleted, whether opened or 
unopened, whether contained directly in the e-mail account or in 
a customized "folder;" 

B. A complete log file of all activity relating to the 
account, including but not limited to dates, times, method of 
connection, port, dial-up, registration IP address, and/or 
location and screen name used each time a particular account is 
accessed. 

C. Subscriber information, including but not limited to the 
subscriber's full name, addresses, telephone numbers, all screen 
names associated with the account and/or the subscriber, account 
number, method of payment, billing records and payment history, 
status and duration of the account, account history (including 
terms of service complaints and staff complaints) , status and 
duration of the account. 

D. All records of subscriber account preferences maintained 
by or related to the account . 

E. All email addresses, names and telephone numbers listed 
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in the account's buddy list and address book, as well as aliases. 

F. Copies of any correspondence between the account/account 
holders and Yahoo. 

G. The existence of favorite sites, whether saved or 
deleted. 

H. Chat communications sent or received by the account, 
whether saved or deleted. 

Copies of the above described records and stored information 
should be obtained from original storage and provided on CD-R 
(CD-Recordable) media. 



